What to Focus First

What to Focus on FIRST Mission-based cybersecurity

  • Systems supporting the mission, vision, and services
  • Regulatory systems - PCI, HIPAA, SOX, GDPR

Prioritizing remediation is based on quantifying the three primary financial impacts:

  1. Business interruption cost
  2. Data exfiltration cost
  3. Regulatory cost





Author: Dr. Bill Souza | Jun 27, 2022 

Continue Reading...

Cyber Risk Myth

Before even discussing cyber risks to the organization, you need to have identified the systems supporting the mission, vision, and services your organization provides (a.k.a. revenue streams).
This step will allow you to establish "value," so when you discuss cyber risks, you'll confidently be able to discern which risks you'll be able to accept, mitigate, or transfer.
The ISO 27001, specifically clause 4.1, starts with you identifying the organization's objectives; NIST Cybersecurity Framework (NIST CSF) starts with ID.AM-1 & ID.AM-2 starts with identifying and inventorying physical devices and software platforms.
Skipping this critical step will only drive your cybersecurity strategy from an operational to a tactical realm, making it difficult to connect your approach (investment and strategy) to what is important to the organization.

Author: Dr. Bill Souza | Jun 11, 2022 

Continue Reading...

Risk Management Strategy

A strong cybersecurity risk management strategy manages uncertainty cost-effectively and efficiently. Risk management identifies risks early and implements mitigation to avoid or mitigate events.

This encourages well-informed decision-making in the context of your goals and has 5 aspects.

-Goals-and-objectives alignment
-Risk-response selection
-Risk monitoring
-Reporting hazards

Visit our website to learn more!

#CyberRisk #CyberRiskManagement #RiskManagement #RiskAppetite #Risk #RiskAssessment 

#RiskTolerance #RiskAnalysis #NISTCSF #CyberRisk #AssetManagement

Author: Dr. Bill Souza | Jun 09, 2022 

Continue Reading...

Strategy Development & Implementation

Cybersecurity has changed more in the last five years than it has in the ten years preceding it. Cyberattacks are constantly changing and evolving, but cybersecurity professionals must have structure and strategy; without structure and a plan, cybersecurity professionals will continue aimlessly in their pursuit of protecting the organizations they serve.

All this change is chaos and disorder, a new form of fear, uncertainty, and doubt (FUD), one, although backed by facts, fails to have direction or a documented strategy.

If it is so difficult for us to document our cyber assets and identify those assets that have an impact on our organization's revenue, how in the world are we going to do anything about the threats we face?

We can’t, it’s that simple. And any CISO call to arms that suggest we can is a stopgap measure, a call to disillusionment and ultimate disaster because our stopgaps are not solutions. 

Fortunately, there are tools to assist us with strategy...

Continue Reading...

Lost in the Vulnerability Fog

With laws and regulations increasingly requiring organizations to demonstrate that mission or business-critical information systems and IT infrastructures are protected; the challenge becomes, with over 164,000 known vulnerabilities in the Common Vulnerability Exposure (CVE) database and 546 attack patterns, so far identified and documented by Common Attack Patterns Enumeration and Classification (CAPEC), where do you start?

In a study that became known as the “Jam Experiment,” Iyengar and Lepper (2000) were the first to demonstrate the choice overload effect, referring that large choice sets attract people. Still, at the same time, these wide choice sets increase the choice difficulties. As we draw a parallel, cybersecurity professionals face many vulnerabilities (>164,000) and many assets to protect against, leading to unsatisfactory solutions. 

Most guidance offered to Subject Matter Experts (SMEs) or organizations for that matter, lead them to identify the...

Continue Reading...

President Biden’s Statement on National Cybersecurity

cybersecurity governance Apr 25, 2022

President Biden’s Statement on National Cybersecurity

President Biden stated, “If you have not already done so, I urge our private sector partners to harden your cyber defenses immediately by implementing the best practices we have developed together over the last year. You have the power, the capacity, and the responsibility to strengthen the cybersecurity and resilience of the critical services and technologies on which Americans rely.”

However, the real question is, are organizations ready to implement cyber defenses? The basis for this rhetorical question is that with the speed of change, IT transformations, new mandates, and the great resignation, among others, organizations may be challenged to implement cybersecurity strategically. There’s no lack of guidance for Critical Infrastructure or Corporate Infrastructure, with standards and frameworks, such as:

  • ISO/IEC 27001
    • ISO/IEC 27032 on cybersecurity 
    • the multipart ISO/IEC 27033 on network...
Continue Reading...

ISO 27001 and Regulations

compliance cybersecurity Mar 21, 2022

ISO 27001 is one of the most widely used information security standards in the world today. Certification of the Standard by a third-party accrediting body is accepted all across the globe. Certifications have increased by more than 450% in the last decade.

In order to comply with regulations like the EU GDPR and the NIS (Network and Information Systems) Regulations, the ISO27001 must be implemented. Using this method reduces the risks of data breaches.

Learn more by checking out our resources, including our ebooks and podcasts!

#ISO27001 #RiskManagment #RiskAssessment #Compliance #Governance #Hackers 

#InformationSecurity #Malware

Continue Reading...

Tackling Risk Probability and Impact

cybersecurity risk Oct 14, 2021

Today I’ll discuss risk probability and impact and give you some examples to build your own impact and probability table.

  • Probability
  • Impact

Dr. Bill Souza
E|CE - Executive Cyber Education 

Continue Reading...

5 Cybersecurity Challenges


Five challenges 

First, the objective of improving cybersecurity is vague and broad. Sometimes organizations struggle on how to measure any improvements to their cybersecurity posture or post-investment. What is even worst, it’s that you may be measuring the wrong thing. In 2015, the Global Information Security Workforce Study (GISWS) conducted a survey of more than 14,000 security professionals, of which 1,800 were federal employees. The survey concluded that we are not just getting better, but we are going backward.  

Although it seems pessimistic, it is supported by facts; in 2014, one billion records were compromised the year before the survey, which triggered Forbes magazine to refer to 2014 as “the year of the data breach.” If you jump forward to 2021 and benefit from hindsight, we can confirm that the GISWS survey’s conclusion that we are going...

Continue Reading...

Lacking Basic Cybersecurity Practices


I read an article the other day titled, “Global utilities lacking basic cybersecurity practices.” Although the article was focused on utilities, the guidance applies to every industry, so I will touch on a few recommendations that could be useful to you as well, regardless of industry.
The article was based on an interview with Rafael Narezzi, Chief Technology Officer at CF Partners. In the webinar, Narezzi urged energy companies to increase investments in cybersecurity and be proactive. In addition to investments, he encouraged companies to make cybersecurity a main driving force of the business.
Let’s reflect on this statement; it says to increase investment in cybersecurity, which would be wise for any organization; however, increasing investment without a strategy would be detrimental to any business, especially small to medium-sized companies. Perhaps I’m taking this statement out of context, and Narezzi’s audience knew what he meant with it, but let...

Continue Reading...
1 2

50% Complete

Two Step

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.